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PATENT 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re Application of: Charles L. Brabenac Examiner: James K. Trujillo 

Serial No.: 09/746,205 Group Art Unit: 2116 

Filed: December 22, 2000 Docket: 884.336US1 

For: PORT-BASED PACKET FILTER 
Customer No. 21186 

APPEAL BRIEF UNDER 37 CFR § 4L37 

Mail Stop Appeal Brief- Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

The Appeal Brief is presented in response of the Decision on Pre- Appeal Brief 
mailed October 25, 2005 and in support of the Notice of Appeal to the Board of Patent 
Appeals and Interferences, filed on September 14, 2005, from the Final Rejection of 
claims 2, 5, 9, 12, 13 and 15-38 of the above-identified appUcation, as set forth in the 
Final Office Action mailed on June 14, 2005. 

The Commissioner of Patents and Trademarks is hereby authorized to charge 
Deposit Account No. 19-0743 in the amoxmt of $500.00 which represents the requisite 
fee set forth in 37 C.F.R. § 41.2(b)(2). The Appellants respectfully request consideration 
and reversal of the Examiner's rejections of pending claims. 

This Appeal Brief is accompanied by a Petition, as well as the appropriate fee, to 
obtain a five-month extension of the period for responding to the Decision on Pre- Appeal 
Brief Request for Review, thereby moving the deadline for response from November 25, 

2005 to April 25, 2006. 
04/27/E006 HDESTfll 00000116 1S0743 09746205 
01 FCrlAOe 500.00 M 
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1. REAL PARTY IN INTEREST 

The real party in interest of the above-captioned patent application is the assignee, 
INTEL CORPORATION. 
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2> RELATED APPEALS AND INTERFERENCES 



There are no other appeals or interferences known to Appellant that will have a 
bearing on the Board's decision in the present appeal. 
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3, STATUS OF THE CLAIMS 

The present application was filed on December 22, 2000 with claims 1 to 29. A 
non-final Office Action was mailed November 28, 2003, rejecting claims 1 to 29. A 
Final Office Action was mailed April 1, 2004, rejecting pending claims 2, 3, 5, 9, 12-29. 

A non-final Office Action was mailed September 28, 2004, rejecting pending 
claims 2, 3, 5, 9, 12-29. A Final Office Action (hereinafter "the Final Office Action") 
was mailed June 14, 2005, rejecting pending claims 2, 5, 9, 12, 13, 15-38. On April 10, 
2006, the Examiner entered Appellant's Amendment for claims 5, 9, 15, 19, and 25. 

At least claim 12 has been twice rejected, remains pending, and is the subject of 
the present Appeal, along with claims 2, 5, 9, 13, and 15-38. At this time, claims 2, 5, 9, 
12, 13, and 15-38 are currently pending in the Application, stand rejected, and their 
rejection is appealed herein. 
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4. STATUS OF AMENDMENTS 

On April 10, 2006, the Examiner entered Appellant's Amendment for claims 5, 9, 
15, 19, and 25. 
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5. SUMMARY OF CLAIMED SUBJECT MATTER 

Claim 2 describes a method including receiving a packet at a port filter (276), 
wherein the packet comprises a port number (510); determining whether there is a host 
application associated with the port number (520); when there is not a host application 
associated with the port number, discarding the packet (530); and when there is a host 
application assigned to the port number, sending a wake-up message (360) to a power- 
managed host computer that is operable in either a power-managed state or an operational 
state (540). (Figure 3, Figure 5, and the originally filed specification at page 8, lines 6-18 
and page 10, line 9 to page 11, line 23). 

Claim 12 describes a signal-bearing media including instructions. The 
instructions when read and executed by a processor comprise receiving a packet 
comprising a port number (510); determining whether there is a host apphcation 
associated with the number (520); and when there is a host apphcation associated with 
the port number, sending a wake-up message to a power-managed host computer that is 
one of a laptop computer and a portable computer operable in either a power-managed 
state or an operational state (540). (Figure 3, Figure 5, and the originally filed 
specification at page 8, lines 6-18 and page 10, line 9 to page 11, line 23). 

Claim 23 describes an apparatus comprising a port filter (276) to receive a packet 
comprising a port number (510), determine whether there is a host application associated 
with the port number (520), and send a wake-up message to a host computer (110) when 
there is a host application associated with the port number, wherein the host computer is 
operable in either a power-managed state or an operational state (540). (Figure 3, Figure 
5, and the originally filed specification at page 8, lines 6-18 and page 10, line 9 to page 
11, line 23). 

Claim 33 describes an apparatus. The apparatus comprises a first stage filter 
(274) to receive a packet; interrogate the packet as to whether the packet includes data 
that matches selected data of a host computer (110); and reject the packet when the 
packet does not include data that matches selected data of the host computer. The 
apparatus also comprises a second stage filter (276) to receive the packet comprising a 
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port number (510); determine whether there is a host application associated with the port 
number (520), and reject the packet when there is not a host application associated with 
the port number (530), wherein the apparatus further is to present the packet to the host 
computer when there is a host application associated with the port number and when the 
packet includes data that matches the selected data of the host computer. (Figure 3, 
Figure 5, and the originally filed specification at page 8, lines 6-18 and page 10, line 9 to 
page 11, line 23). 

Claim 36 describes a method comprising receiving a packet at a first stage filter 
(274) to interrogate the packet as to whether the packet includes data that matches 
selected data of a host computer; rejecting the packet when the packet does not include 
data that matches selected data of the host computer; receiving the packet at a second 
stage filter (276), wherein the packet comprises a port number (510); determining 
whether there is a host application associated with the port number at the second stage 
filter (520); and rejecting the packet when there is not a host application associated with 
the port number (530). (Figure 3, Figure 5, and the originally filed specification at page 
8, lines 6-18 and page 10, line 9 to page 11, line 23). 

This summary does not provide an exhaustive or exclusive view of the present 
subject matter, and Appellant refers to the appended claims and its legal equivalents for a 
complete statement of the claimed invention. 
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6. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Claims 2, 3, 5, 9 and 12-13 and 15-30 were rejected under 35 USC § 103 as being 
unpatentable over Graham-Cumming, Jr. (U.S. 6,182,146) in view of McKaughan et al. 
(U.S. 5,802,305). Applicant notes that the prior office action refers to claims 12-30 as 
rejected under 35 USC § 103, however, claim 14 was previously canceled. 

Claims 31-38 were rejected under 35 USC § 103(a) as being unpatentable over 
Novoa et al. (U.S. 6,493,824) in view of Graham-Cumming, Jr. 
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7. ARGUMENT 

7.1 The Applicable Law 

The Examiner has the burden under 35 U.S.C. §103 to estabUsh a prima facie case of 
obviousness. In refine, 837 F.2d 1071, 1074, 5 USPQ2d 1596, 1598 (Fed. Cir.1988). As 
part of estabUshing a prima facie case of obviousness, the Examiner must show that some 
objective teaching in the prior art or some knowledge generally available to one of ordinary 
skill in the art would lead an individual to combine the relevant teaching of the references. 
Id. 

The court in Fine stated that: 

Obviousness is tested by "what the combined teaching of the 
references would have suggested to those of ordinary skill in the art.'* In 
re Keller, 642 F.2d 413, 425, 208 USPQ 871, 878 (CCPA 1981)). But it 
"cannot be established by combining the teachings of the prior art to 
produce the claimed invention, absent some teaching or suggestion 
supporting the combination." ACS Hosp. Sys., 732 F.2d at 1577, 221 
USPQ at 933. And "teachings of references can be combined only if there 
is some suggestion or incentive to do so." 

Id. (emphasis in original). 

The M.P.E.P. adopts this line of reasoning, stating that 

"In order for the Examiner to establish a prima facie case of 
obviousness, three base criteria must be met. First, there must be some 
suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify 
the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or 
references when combined) must teach or suggest all the claim limitations. 
The teaching or suggestion to make the claimed combination and the 
reasonable expectation of success must both be found in the prior art, and 
not based on Appellant's disclosure. In re Vaeck, 947 F.2d 488, 20 USPQ 
2d 1438 (Fed.Cir. 1991))." M.P.E.P. §2142. (emphasis added.) 

Motivation to combine or modify the prior art is lacking when the prior art 
teaches away from the claimed combination. A reference may be said to teach away 
when the reference suggests a path direction that is divergent from the path the Appellant 
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took. In re Gurley, 27 F.3d 551, 31 USPQ 2d 1130, 1131 (Fed. Cir. 1994); United States 
V. Adams, 383 U.S. 39, 52, 148 USPQ 479, 484 (1966); In re Sponnoble, 405 F.2d 578, 
587, 160 USPQ 237, 244 (C.C.P.A. 1969); In re Caldwell 319 F.2d 254, 256, 138 USPQ 
243,245 (C.C.P.A. 1963). 

If a proposed modification would render the prior art invention being modified 
unsatisfactory for its intended purpose, then there is no suggestion or motivation to make 
the proposed modification. In re Gordon, 733 F,2d 900, 221 USPQ 1125 (Fed. Cir. 
1984); MPEP §2143.01. 

Additionally, while it is true that it is the teachings, not the actual physical 
embodiments, of references that are considered in making an obvious determination 
under 35 USC §103 {In re Keller at 425), on the other hand, it is equally true that if the 
teachings of a prior art reference would lead one skilled in the art to make a modification 
which would render another prior art device inoperable, then such a modification would 
generally not be obvious. In re Gordon, 733 F.2d 900, 902, 2212 USPA 1 125, 1 127 (Fed 
Cir. 1984). 

The Examiner must avoid hindsight. In re Bond, 910 F.2d 831, 834, 15 USPQ2d 
1566, 1568 (Fed. Cir. 1990). "Obviousness may not be estabHshed using hindsight or in 
view of the teachings or suggestions of the inventor." Para-Ordnance Mfg., Inc. v. SGS 
Importers Intl Inc., 73 F.3d 1085, 1087, 37 USPQ2d 1237, 1239 (Fed. Cir. 1995), cert, 
denied, 117 S.Ct. 80 (1996) citing W.L Gore&Assocs. v. Garlock Inc., Ill F.2d 1540, 
1553, 220 USPQ 303, 312-13, cert, denied, 469 U.S. 851 (1984). 

7.2 Discussion of the rejection of claims 2, 3, 5, 9, 12-13 and 15-30 over Graham in 
view of McKaughan. 

This rejection is erroneous because the Examiner failed to show motivation of 
record to modify the Graham reference, and failed to show reasonable expectation of 
success of the proposed combination of Graham and McKaughan. 
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The stated purpose of Graham includes determining an appropriate appUcation for an 

incoming packet, even when the application for the packet is unknown: 

"hi the present invention, the apphcation-port mapping table will initially not 
contain an association between the dynamic port and an application identifier, and 
thus the application for the packet will be unknown. However, unlike 
conventional approaches, the packet analysis module then analyzes the packet to 
determine the appropriate application for handling the packet^ Graham, col. 3, 
lines 26-32 (emphasis added). 

Further, in Figure 6 of Graham, the flow chart at 609 to 61 1 indicates that after 
determining that the application for the packet is unknown, Graham continues to attempt 
to identify an application for the packet. Graham, col. 10, lines 42-62. Graham's flow 
chart of Figure 7 likewise shows a continued attempt to identify an application for the 
packet after determining that there is not an application for the packet. See blocks 719, 
721, 723, and 725 of Figure 7 in Graham. 

Ultimately, Graham is so determined to "handle" each incoming packet by 
identifying some application to process the packet, that Graham may then pass the packet 
to a default application when the application identifier associated with the packet is 
unknown, even after the continued failed attempts to determine an appropriate 
application. Graham, Figure 6, block 623 and Figure 7, block 717. 

Clearly, the purpose of Graham includes being persistent in determining an 
application for each incoming packet, even when the application (for processing an 
incoming packet) is unknown. 

In direct contrast to the purpose of Graham, the Examiner proposes to modify 
Graham to preclude the possibility of passing the packet to a default application in the 
instance where an appropriate application is not identified. However, t he Examiner has 
simply failed to show motivation of record to modify Graham to preclude the purpose of 
Graham. Also, because the option of passing the packet to a default application is 
precluded in this proposed modification, the modification renders Graham unsatisfactory 
for its intended purpose. Further, ironically, this proposed modification actually puts 
Graham more in line with the ''conventional approaches " that Graham was seeking to 
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distinguish itself from, where there is no persistent determination with regard to 
identifying the application for the packet. 

The requirement of a suggestion or motivation to combine references in a prima 
facie case of obviousness is emphasized in the Federal Circuit opinion, In re Sang Su 
Lee, 277 F.3d 1338; 61 U.S.P.Q.2D 1430 (Fed, Cir. 2002), which indicates that the 
motivation must be supported by evidence in the record. 

Appellant respectfully submits that the Examiner failed to put into evidence that 
which was needed to make a prima facie case of obviousness. Specifically, there is no 
evidence of record that indicates motivation to modify Graham to preclude the possibility 
of passing the packet to a default application in the instance where an appropriate 
application is not identified, as suggested in the Action. Absent such evidence, there is 
no demonstrated motivation for the proposed modification of the Graham reference. 

Further, because there is no evidence of record that indicates motivation to 
modify Graham to preclude the possibility of passing the packet to a default apphcation 
in the instance where an appropriate application is not identified, as suggested in the 
Action, there cannot be a reasonable expectation of success of the proposed combination 
of Graham and McKaughan. 

The addressable memory 303 of Graham includes the software product 304 
(packet analysis module 100). Figure 4, and column 8, hnes 25-38 of Graham. 
McKaughan, on the other hand, refers to powering down the computer except for power 
to the network interface card, before analyzing packets. See 340 of Figure 3, and see 
Figure 4. 

Modifying the computer 300 of Graham as suggested in the Action would render 
the packet analysis module 100 of Graham inoperable. By powering down the computer 
300 of Graham, the packet analysis module 100 would simply not have power and thus 
not be able to execute. Even if a network interface 306 of Graham was with power while 
the computer 300 was powered down, there is no demonstrated indication in the record to 
modify the network interface 306 of Graham, such that the packet analvsis module 100 
would be moved to be included in the "powered" network interface 306. 
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Appellant respectfully submits that the Examiner failed to put into evidence that 
which was needed to make a prima facie case of obviousness. Specifically, there is no 
evidence of record that indicates motivation to modify the network interface 306 of 
Graham to include software and hardware as suggested in the Action. Absent such 
evidence, there is no demonstrated motivation for the proposed modification of the 
network interface 306 of Graham. Therefore, there is simply no evidence of record to 
show motivation for Graham to operate in low power to analyze packets. 

Further, because there is no evidence of record that indicates motivation to 
modify the network interface 306 of Graham to include software and hardware as 
suggested in the Action, there cannot be a reasonable expectation of success of the 
proposed combination of Graham and McKaughan. 

hi addition, because the computer 300 of McKaughan refers to powering 
down the computer except for power to the network interface card, before 
analyzing packets, and because Graham is to be powered on to analyze the 
packets and simply can not operate in low power to analyze packets, the only way 
to combine Graham and McKaughan is through hindsight. Because obviousness 
may not be established without demonstrated motivation to modify the reference, 
and may not be established without showing reasonable expectation of success of 
the proposed combination, the Examiner has not established a prima facie case of 
obviousness for independent claims 2, 12, and 23. Therefore, the rejection under 
35 U.S.C. § 103(a) cannot stand and claims 2, 12, and 23 are patentable over these 
cited references. 

Claims 3, 5, 9, 13-22 and 24-30 depend from independent claims 2, 12, or 23 and 
incorporate all of the limitations therein, respectively. Claims 3, 5, 9, 13-22 and 24-30 
are also asserted to be allowable for the reasons presented above, and Appellant 
respectfully requests notification of same. Appellant considers additional elements of 
claims 3, 5, 9, 13-22 and 24-30 to further distinguish over the cited references, and 
Appellant reserves the right to present arguments to this effect at a later date. 
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73 Discussion of the rejection of claims 31-38 over Novoa in view of Graham. 

This rejection is erroneous for the following reasons: the Examiner failed to show 
motivation of record to combine Novoa and Graham to arrive at the present claims, and 
the Examiner failed to show motivation of record to modify the Novoa reference. 

The Examiner failed to show motivation of record to combine Novoa and Graham. 

With regard to independent claim 33, the Action states on pages 8-9 that Graham 

refers to "dynamic ports are frequently used to provide security [and Graham's invention] 

further provides the advantage of improve accuracy in the detection and accounting of 

traffic data." The Examiner concludes that it would have been obvious: 

"to one having ordinary skill in the art, having the teachings of 
Novoa and Graham before them at the time the invention was made, to 
modify the second filter of Novoa to include the filter as taught by 
Graham. One of ordinary skill in the art would have been motivated to 
make the modification in order to improve the accuracy in the detection 
and accounting of traffic and accurately report and manage such traffic. 
Further, Graham suggests that such a filter would be useful for providing 
security in such a network system." 

Appellant respectfully disagrees. 

First, the statement that "Graham suggests that such a filter would be useful for 
providing security in such a network system" is not supported. Column 1, lines 60-64 of 
Graham specifically recites: "Indeed, dynamic ports are fi-equently used, for example to 
provide for security or for improved resource sharing. Accordingly, there is a need to be 
able to handle dynamic mappings for network traffic." There is nothing of record to 
suggest how the "dynamic ports" of Graham are used to provide for security. 
Indeed, there is a possibility that the dynamic port may be used as an endpoint in a 
secure process, without itself being a security filter. Further, column 1, lines 60-64 
of Graham does not equate "filter" with "dynamic port." Appellant respectfully 
submits that the Examiner failed to put into evidence that which was needed to make a 
prima facie case of obviousness. Specifically, there is no evidence of record that 
indicates equivalency "filter" and "dynamic port" as suggested in the Action. Absent 
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such evidence, the asserted statement of equivalency cannot demonstrate motivation to 
combine the references as suggested in the Action. 

Second, there is no evidence of motivation in Novoa to look to Graham to 
provide motivation to combine these references. In particular, there is no 
demonstrated indication in the record that Novoa is attempting to "improve the 
accuracy in the detection and accounting of traffic and accurately report and 
manage such traffic," as stated in the Action. Therefore, there is simply no 
indication in the Action of motivation in Novoa to look to Graham for a 
suggestion to combine the two references. Again, there must be evidence of 
record to suggest the combination. In re Sang Su Lee, 277 F.3d 1338; 61 
U.S.P.Q.2D 1430 (Fed. Cir. 2002). Appellant respectfully submits that the 
Examiner failed to put into evidence that which was needed to make a prima facie 
case of obviousness. Specifically, there is no evidence of record that indicates a 
motivation for Novoa to look to Graham for motivation to "improve the accuracy 
in the detection and accoxmting of traffic and accurately report and manage such 
traffic" in Novoa. Absent such evidence, there is no demonstrated motivation for 
the proposed combination. 

Therefore, the Examiner failed to show motivation of record to combine Novoa 
and Graham to arrive at the present claims. 

The Examiner failed to show motivation of record to modify the Novoa reference. 

The stated piupose of Novoa includes the following: 

". . .it is desirable for a computer system in a power down state to be able 
to discriminate between authorized wake-up packets and unauthorized wake-up 
packets." Novoa, col. 4, lines 43-45 (emphasis added). 

To ensure the packet originated fi-om the authorized source, Novoa recites: 

"Preferably, the security field value has been encrypted by an authorized 
source's private key. In a standard public key/private key encryption scheme, this 
means that the message can only be correctly decrypted by using the 
corresponding public key. If in fact the authorized source is the only one in 
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possession of the private key, successful decryption using the public key ensures 
that the packet originated from the authorized source." Novoa, col. 9, lines 35-42. 

The Examiner suggests that Novoa be modified such that the "second fiUer for 
security purposes [at] step 414, col. 9, lines 43-53" of Novoa includes the "filter" as 
taught by Graham. Graham's "filter" identifies an application based on packet data using 
an application port mapping table. However, there is no suggestion in the Action that 
Graham's "filter" discriminates between authorized wake-up packets and unauthorized 
wake-up packets. If, for example, the system of the proposed combination of Novoa and 
Graham received a packet associated with an installed universal application, assuming the 
packet made it through the "first filter" of Graham, the system would be woken up, and 
the packet would then be handled. There would simply be no discrimination between 
authorized wake-up packets and unauthorized wake-up packets as taught by Novoa. 
Therefore the proposed modification of Novoa simply renders Novoa unsatisfactory for 
its intended purpose, which is to discriminate between authorized wake-up packets and 
unauthorized wake-up packets. 

In specific response to comments in the Advisory Action, if the proposed 
modification modifies the "second filter" of Novoa to "include" the filter of Graham, 
without replacing Novoa' s second filter, this appears not to be a "modification" of the 
second filter, but rather is a proposed addition of yet a third filter to Novoa. 

The Action states that "one of ordinary skill in the art would have been motivated 
to make the modification in order to improve the accuracy in the detection and 
accounting of traffic and accurately report an manage such traffic. Further Graham 
suggests that such a filter would be usefiil for providing security in such a network 
system." 

Again, Graham's "filter" is not concerned with security, but rather is concerned 
with identifying an appropriate application for the incoming packets. 

Again, there is no demonstrated indication in the Action that Novoa suggests 
attempting to "improve the accuracy in the detection and accounting of traffic and 
accurately report and manage such traffic," as stated in the Action. Likewise, Appellant 
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is simply unable to find anything in the record that demonstrates supported motivation in 
Novoa to include yet another "security filter," specifically the packet analysis module 
100 of Graham, into Novoa. 

Therefore, the Examiner failed to show motivation of record to modify the Novoa 
reference to include Graham's "filter." 

Because obviousness may not be established without demonstrating motivation in 
the record to combine references or modify a reference, the Examiner has not established 
di prima facie case of obviousness for independent claims 33 and 36. The rejection under 
35 U.S.C. § 103(a) cannot stand. Thus, because there is no demonstrated motivation to 
combine the references, claims 33 and 36 are patentable over these cited references. 

Claims 31, 32, 34, 35, 37, 38 depend from one of independent claims 2, 33 or 36 
and incorporate all of the limitations therein, respectively. Claims 31, 32, 34, 35, 37, 38 
are also asserted to be allowable for the reasons presented above, and Appellant 
respectfully requests notification of same. Appellant considers additional elements of 
claims 31, 32, 34, 35, 37, 38 to further distinguish over the cited references, and 
Appellant reserves the right to present arguments to this effect at a later date. 
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8. SUMMARY 



For the reasons argued above, claims 2, 3, 5, 9, and 12-30 were not properly 
rejected under § 103(a) as being obvious over Graham in view of McKaughan. 

Also, for the reasons argued above, claims 31-38 were not properly rejected under 
§ 103(a) as being obvious over Novoa in view of Graham. 

It is respectfully submitted that the art cited does not render the claims obvious 
and that the claims are patentable over the cited art. Reversal of the rejections and 
allowance of the pending claims are respectfully requested. 



Respectfully submitted, 

CHARLES L. BRABENAC 

By his Representatives, 

SCHWEGMAN, LUNDBERG, 
WOESSNER & KLUTH, P.A. 
P.O. Box 2938 
Minneapolis, MN 55402 




CERTIFICATE UNDER 37 CFR 1.8: The undersigned hereby certifies that this correspondence is being deposited with the United 
States Postal Service with sufficient postage as first class mail, in an envelope addressed to: Mail Stop Appeal Brief - Patents, 
Commissioner for Patents, P.O. Box 1450, Alexandria, VA 22313-1450, on this 25th day of April, 2006. 



Name Signature 
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CLAIMS APPENDIX 

2. A method, comprising: 

receiving a packet at a port filter, wherein the packet comprises a port number; 

determining whether there is a host application associated with the port number; 

when there is not a host application associated with the port number, discarding 
the packet; and 

when there is a host application assigned to the port number, sending a wake-up 
message to a power-managed host computer that is operable in either a power-managed 
state or an operational state. 

5. The method of claim 2, further comprising: 

receiving information from the host computer; and 

using the information to carry out determining whether there is a host application 
associated with the port number, wherein the information comprises executable 
instructions. 

9. The method of claim 2, further comprising: 

detecting a port in use by the host application; 

selecting information based on the port in use by the host application; and 
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sending the information to the port filter, wherein the port fiUer uses the 
information to carry out determining whether there is a host apphcation associated with 
the port number, wherein the information comprises executable instructions. 

12. (Rejected) A signal-bearing media comprising instructions, wherein the 
instructions when read and executed by a processor comprise: 

receiving a packet comprising a port number; 

determining whether there is a host application associated with the number; and 
when there is a host application associated with the port number, sending a wake- 
up message to a power-managed host computer that is one of a laptop computer and a 
portable computer operable in either a power-managed state or an operational state. 

13. The signal-bearing media of claim 12 further comprising: 

when there is not a host application assigned to the port, discarding the packet. 

15. The signal-bearing media of claim 12, further comprising: 
receiving information from the host computer; and 

using the information to carry out determining whether there is a host application 
associated with the number. 



16. The signal-bearing media of claim 15, wherein the information comprises executable 
instructions. 
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17. The signal-bearing media of claim 15, wherein the infomiation comprises data, and 
wherein the data is to describe the host application. 

18. The signal-bearing media of claim 15, wherein the information comprises data, and 
wherein the data is to describe the port number. 

19. The signal-bearing media of claim 12, further comprising: 

detecting a port in use by the host application; 

selecting information based on the port in use by the host application; and 
sending the information to a port filter, wherein the port filter uses the information 
to carry out determining whether there is a host application associated with the number. 

20. The signal-bearing media of claim 19, wherein the information comprises executable 
instructions. 

21 . The signal-bearing media of claim 19, wherein the information comprises data, 
wherein the data describes the host application. 

22. The signal-bearing media of claim 19, wherein the information comprises data, 
wherein the data describes the port number. 
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23. An apparatus, comprising: 

a port filter to 

receive a packet comprising a port number, 

determine whether there is a host application associated with the port 
number, and 

send a wake-up message to a host computer when there is a host 
application associated with the port number, wherein the host computer is 
operable in either a power-managed state or an operational state. 

24. The apparatus of claim 23, wherein the port filter further is to: 

discard the packet when there is not a host application associated with the port number. 

25. The apparatus of claim 23, wherein the port filter fiirther is to: 

receive program information from the host computer; and 
use the program information to execute determining whether there is a host 
application associated with the port number. 

26. The apparatus of claim 25, wherein the program information comprises executable 
instructions. 

27. The apparatus of claim 25, wherein the program information comprises data to 
describe the host application. 
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28. The apparatus of claim 25, wherein the program information comprises data to 
describe the port number. 

29. The apparatus of claim 23, wherein the wake-up message is to cause the host 
computer to change from the power-managed state to the operational state. 

30. The method of claim 2 further comprising sending the packet to the power-managed 
host computer when there is a host application associated with the port number. 

31. The method of claim 2 further comprising applying a first stage filter to: 

receive the packet; 

interrogate the packet as to whether the packet includes data that matches selected 
data of the host computer; 

forward the packet when the packet includes data that matches selected data of the 
host computer; and 

reject the packet when the packet does not include data that matches selected data 
of the host computer. 

32. The method of claim 31 wherein the first stage filter includes a pattem filter. 
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33. An apparatus, comprising: 
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a first stage filter to: 

receive a packet; 

interrogate the packet as to whether the packet includes data that 
matches selected data of a host computer; and 

reject the packet when the packet does not include data that 
matches selected data of the host computer; 
a second stage filter to: 

receive the packet comprising a port number; 

determine whether there is a host application associated with the 
port number; and 

reject the packet when there is not a host application associated 
with the port number, 

wherein the apparatus further is to present the packet to the host 
computer when there is a host application associated with the port nimiber 
and when the packet includes data that matches the selected data of the 
host computer. 



34. The apparatus of claim 33 wherein when there is a host application associated with 
the port number and when the packet includes data that matches the selected data of the 
host computer, the apparatus further is to send a wake-up message to the host computer, 
wherein the host computer is operable in either a power-managed state or an operational 
state. 
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35. The apparatus of claim 33 wherein the first stage filter includes a pattern filter and 
the second stage filter includes a port filter. 

36. A method, comprising: 

receiving a packet at a first stage filter to interrogate the packet as to whether the 
packet includes data that matches selected data of a host computer; 

rejecting the packet when the packet does not include data that matches selected 
data of the host computer; 

receiving the packet at a second stage filter, wherein the packet comprises a port 
number; 

determining whether there is a host application associated with the port number at 
the second stage filter; and 

rejecting the packet when there is not a host application associated with the port 
number. 

37. The method of claim 36, when there is a host application associated with the port 
number and when the packet includes the data that matches the selected data of the host 
computer, the method further comprising selecting from a group including: 

sending a wake-up message to the host computer that is operable in either a 
power-managed state or an operational state, and 
presenting the packet to the host computer. 
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38. The method of claim 36 wherein the first stage filter includes a pattem filter and the 
second stage filter includes a port filter. 
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None. 
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